In rd_req_dec, always log non-permitted enctypes

The buffer specified in negotiate_etype() is too small for use with
the AES enctypes when used with krb5_enctype_to_string(), so switch to
using krb5_enctype_to_name().

diff --git a/src/lib/krb5/krb/rd_req_dec.c b/src/lib/krb5/krb/rd_req_dec.c
index 4cd429a1110e8264cec3f9f4cad29ad33c85a84f..e75192fee0a92acaacda63e77b55dc2434fe3dfe 100644 (file)
--- a/src/lib/krb5/krb/rd_req_dec.c
+++ b/src/lib/krb5/krb/rd_req_dec.c
@@ -864,9 +864,8 @@ negotiate_etype(krb5_context context,
         if (permitted == FALSE) {
             char enctype_name[30];
 
-            if (krb5_enctype_to_string(desired_etypes[i],
-                                       enctype_name,
-                                       sizeof(enctype_name)) == 0)
+            if (krb5_enctype_to_name(desired_etypes[i], FALSE, enctype_name,
+                                     sizeof(enctype_name)) == 0)
                 k5_setmsg(context, KRB5_NOPERM_ETYPE,
                           _("Encryption type %s not permitted"), enctype_name);
             return KRB5_NOPERM_ETYPE;

diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py
index ee43ff028ca79c010c748b1b04f8e62a480b4cf5..5d9f80e04144915ed43884d253762de2bc160e73 100755 (executable)
--- a/src/tests/gssapi/t_enctypes.py
+++ b/src/tests/gssapi/t_enctypes.py
@@ -85,7 +85,8 @@ test('both aes128', 'aes128-cts', 'aes128-cts',
 # If only the acceptor constrains the permitted session enctypes to
 # aes128, subkey negotiation fails because the acceptor considers the
 # aes256 session key to be non-permitted.
-test_err('acc aes128', None, 'aes128-cts', 'Encryption type not permitted')
+test_err('acc aes128', None, 'aes128-cts',
+         'Encryption type aes256-cts-hmac-sha1-96 not permitted')
 
 # If the initiator constrains the permitted session enctypes to des3,
 # no acceptor subkey will be generated because we can't upgrade to a
@@ -128,7 +129,7 @@ test('upgrade init des3+rc4', 'des3 rc4', None,
 # is only for the sake of the kernel, since we could upgrade to an
 # aes128 subkey, but it's the current semantics.)
 test_err('upgrade acc aes128', None, 'aes128-cts',
-         'Encryption type ArcFour with HMAC/md5 not permitted')
+         'Encryption type arcfour-hmac not permitted')
 
 # If the acceptor permits rc4 but prefers aes128, it will negotiate an
 # upgrade to aes128.